The purpose of this policy is to provide guidance and support for information security management in accordance with the requirements of medical activity and applicable regulations.
This policy contains a description of key elements, both human and organizational, technological and documentary, that ASCIRES Grupo Biomédico (hereinafter ASCIRES) applies to protect information, and especially personal data, preventing security incidents that endanger them.
At all levels of ASCIRES, the real and effective application of the prevention and control measures provided for in this policy will be ensured, so that this management system achieves the elimination or reduction of behaviors that may endanger the security of information assets and personal data processed by ASCIRES.
This policy will be adapted to the technological and legislative changes that occur. in the future.
ASCIRES' fundamental objective is to provide patients with precision diagnostic services, radiotherapy treatments, nuclear medicine, as well as specialized and personalized care in medical consultations with outpatient surgery.
The vocation for the patient, the passion for technological innovation and the humanization of treatment are the hallmarks shared by ASCIRES. Due to its technology and the number of patients treated annually, ASCIRES is the pioneering biomedical group in Spain in Diagnostic Imaging and Nuclear Medicine, as well as a benchmark in Radiotherapy Oncology.
ASCIRES, within its scope of action, provides services related to activity within the healthcare sector.
This means that its main assets are intangible in nature and are mainly made up of confidential information, such as patient medical information or information related to scientific research, personal data, intellectual property, industrial property, among others.
The intangible nature of this type of assets makes them very vulnerable to internal and external threats such as unauthorized access, unauthorized copying, disclosure, transfer to third parties, unauthorized use, unauthorized exploitation and even destruction.
The protection of information assets requires a series of legal, technical and organizational measures that are summarized in this policy and detailed in the rules and procedures of ASCIRES.
This policy applies to the following areas of ASCIRES:
Based on the above, and taking into account the requirements applicable to ASCIRES in terms of security, the following formal scope is established, which defines the areas that must comply with the specifications of the National Security Scheme:
“The information systems that support the radiodiagnostic and nuclear medicine services that support healthcare and non-healthcare processes and activities in accordance with the current categorization document.”
National and European:
Guides and standards:
Registry of applicable Guides: “Control Guides Applicable”.
Ascires Protection Policy.
The objective of information security is to guarantee the quality of the information and the continued provision of services, acting preventively, monitoring daily activity and reacting diligently to incidents.
The systems managed by ASCIRES must be managed diligently, taking appropriate measures to protect them against accidental or deliberate damage that may affect the availability, integrity or confidentiality of the information processed or the services provided.
To defend against these threats, a strategy is required that adapts to changes in the conditions of the ASCIRES environment and thus guarantee the continued provision of services. services.
Certain areas that make up ASCIRES must apply the minimum security measures required by the National Security Scheme, since they provide services to the Public Administration, as well as continuously monitor the levels of service provision, follow and analyze reported vulnerabilities, and prepare an effective response to incidents to ensure the continuity of the services provided.
The different departments must ensure that security in information systems is an integral part of each stage of the system's life cycle, from its conception to its withdrawal from service, including development or acquisition decisions and exploitation activities.
The departments must be prepared to prevent, detect, react to and recover from security incidents, in accordance with Article 8 of the ENS.
The objectives of ASCIRES in terms of information security are aligned with those of medical activity, giving priority to compliance with the legal obligations that are applicable to the activity carried out.
Compliance with the General Data Protection Regulation of the European Union and the regulations regarding the protection of personal data in force in the countries in which ASCIRES operates is considered a priority objective of information security.
At all levels of ASCIRES there will be a commitment to comply with the objectives set in terms of information security and to apply the established controls.
The ASCIRES security strategy will comply with the principles of confidentiality, integrity, availability, authenticity and traceability of information.
The principle of confidentiality guarantees that information is only accessible to users authorized to access it and that it cannot be disclosed to third parties without the corresponding authorization.
The principle of integrity guarantees that data will be kept free from unauthorized modifications and that existing information has not been altered by unauthorized persons or processes.
The principle of availability guarantees that information will be accessible and usable on a constant basis, ensuring the continuity of processes and medical activity. This principle is linked to the principle of resilience, which consists of ensuring the ability of systems and information to recover after an incident that prevents temporary access to them.
The principle of authenticity guarantees that the origin and identities associated with the information are really those that appear in its attributes. This principle is linked to the principle of non-repudiation, which consists of ensuring that a user cannot deny the authorship of an act in the system or the link to a piece of data or set of data.
The principle of traceability guarantees the possibility of determining at any time the identity of the people who access the information and the activity they carry out in relation to it, as well as the different states and routes that the information has followed.
A principle of proportionality will be applied between the controls to be applied and the severity of the risk to be prevented, detected or mitigated.
In new services and developments, the principle of security by design and by default will be applied.
All roles and responsibilities will be differentiated and assigned individually in the job description. In addition to this individualized assignment, all persons belonging to ASCIRES, regardless of the level, will be obliged to comply with the rules, procedures and controls established in terms of information security.
The highest authority for control in terms of information security will correspond to the administrative body, which will be supported by the Data Protection and Information Security Committee, which includes the Chief Information Security Officer (CISO), who will be responsible for ensuring compliance with this policy and reporting any relevant issue to the Committee.
ASCIRES may develop rules and procedures that develop, specify and detail the control measures indicated in this policy.
When managing In terms of information security, ASCIRES has taken international standards such as ISO 27001 as a reference; however, considering that ASCIRES also provides specific services to the Public Administration, the provisions of the National Security Scheme are also applied.
In accordance with article 12.1 of Royal Decree 311/2022, of May 3, which regulates the National Security Scheme, clear persons responsible for ensuring compliance with the Security Policy must be identified and must be known by all members of ASCIRES.
ASCIRES will adopt the necessary measures so that staff are comprehensible about the security regulations that affect the development of their functions, as well as the consequences that could be incurred in the event of non-compliance.
* The following roles are established in ASCIRES related to Information Security:
|
ROLES |
FUNCTIONS |
|
Service Manager |
Determine the security requirements of the services provided, for which purpose the impact of an incident affecting the security of the services with harm to availability, authenticity, integrity, confidentiality or traceability will be assessed. |
|
Information Manager |
Determine the security requirements of the information processed, for which he/she will assess the impact that an incident affecting the security of the information with damage to the availability, authenticity, integrity, confidentiality or traceability would have. |
|
Security Manager |
He/she will determine the decisions to satisfy the security requirements of the information and the services, supervising the implementation of the necessary measures and reporting on these issues. |
|
System Manager |
He/she will be responsible for developing the specific way of implementing security in the system and for supervising its daily operation, being able to delegate to administrators or operators under his/her control. responsibility |
|
Security Administrator |
He is in charge of the technical security tasks, who executes them. |
The Service Manager has the following associated functions:
Establishes the security requirements of the services. Within the framework of the ENS, it is equivalent to the power to determine the security levels of the Service.
The person responsible for the Information System has the following associated functions:
He has the ultimate responsibility for the use made of certain information and,
therefore, for its protection.
The Information Security Manager has the following associated functions:
|
ROLES |
DESIGNATION |
|
Service Manager |
The functions of the ASCIRES Service Manager will be assumed by the Director of Operations |
|
Information Manager |
The functions of the ASCIRES Information Manager will be assumed by the Director of Operations Director of Operations |
|
Security Officer |
The functions of the ASCIRES Information Security Officer will be assumed by the Chief Information Security Officer (CISO) |
|
System Manager |
The functions of the System Manager at ASCIRES will be assumed by the IT Infrastructure Systems Manager. |
|
Administrator of the Security |
The functions of the Security Administrator at ASCIRES will be assumed by the IT Infrastructure Systems Manager. |
This is the body that coordinates Information Security at an internal level at ASCIRES.
It will be made up of the Service Manager, the Security Manager, the Information Manager and the System Manager.
Likewise, the DPO and the Legal Department Director will be integrated into the Data Protection and Information Security Committee, whose functions are detailed in the Data Protection Policy.
The Data Protection and Information Security Committee will have the following functions:
The Security Officer will assume the functions of the secretariat of the Data Protection and Information Security Committee, which will be those detailed below:
The Information Security Officer will transfer to the ASCIRES Data Protection and Information Security Committee those aspects that have been discussed with the Security Officer when they must be managed jointly with the City Council.
The hierarchy of roles is described as follows:
The Information Security Officer reports to the Management of the organization, as agreed in the Data Protection and Information Security Committee.
The vote or decision of the Information Security Officer will prevail in the event of a tie in the decisions taken by the other members of the Data Protection and Information Security Committee. Information.
All systems subject to this Policy must perform a risk analysis, assessing the threats and risks to which they are exposed.
ASCIRES periodically and continuously performs a risk analysis of the threats that affect information security.
The risk analysis is performed through an inherent risk map, in which the gross risks existing before the application of prevention, detection and mitigation controls are assessed, and through a residual risk map, in which the net risks existing after the application of controls are assessed.
The risk analysis will be the basis for determining the security measures that must be adopted in addition to the minimums established by the National Security Scheme, as provided for in Article 7 9.2 RISK ASSESSMENT CRITERIA
In order to harmonize risk analyses, the Data Protection and Information Security Committee will establish a reference assessment for the different types of information handled and the different services provided.
The detailed risk assessment criteria will be specified in the risk assessment methodology that ASCIRES will develop, based on recognized standards and good practices.
At least, all risks that may seriously impede the provision of services or the fulfillment of ASCIRES' mission must be addressed.
Special priority will be given to risks that imply a cessation of the provision of services to citizens.
At all levels of ASCIRES, there will be an obligation to immediately communicate the information security risks that are being handled. identify.
These risks will be communicated through the channels that ASCIRES has enabled to communicate any type of threat to people, assets or regulatory compliance.
Risk analysis and its treatment must be a regularly repeated activity, as established in Article 10 of the ENS. This analysis will be repeated:
ASCIRES processes personal data. The Register of Processing Activities, which will only be accessible to authorized persons, includes the affected processing and the corresponding controllers.
All ASCIRES information systems will comply with the security required by the regulations on personal data protection in accordance with the risk analysis carried out for the nature and purpose of the personal data collected in the Register of Processing Activities of the organization.
The areas that make up ASCIRES must avoid, or at least prevent as far as possible, that the information or services are harmed by security incidents.
To do this, the areas that make up ASCIRES must implement the minimum security measures determined by the ENS, as well as any additional control identified through a threat and risk assessment.
These controls, and the security roles and responsibilities of all personnel, should be clearly defined and documented.
To ensure compliance with the policy, areas or departments should:
Since services can be rapidly degraded by incidents, ranging from a decrease to a cessation of the level of provision, services should continuously monitor the operation to detect anomalies in the levels of service provision and act accordingly.
Training may be based on face-to-face sessions or e-Learning courses. This training may be based on any type of communication and training material and instruments that allow awareness of criminal risks at all levels of ASCIRES.
ASCIRES will perform the following functions in terms of training and awareness:
Compliance with this Security Policy is mandatory for all internal or external personnel involved in ASCIRES processes, with the consequences of non-compliance with the Security Policy being those established in the regulations in force in each country. moment.
When services are provided or information is managed for other organizations, they will be made aware of this Information Security Policy, which is published on the ASCIRES website and headquarters. Channels will be established for reporting and coordination of the respective Security Committees and procedures will be established for action to react to security incidents.
When third-party services are used or information is transferred to third parties, they will be made aware of this Security Policy and the Security Regulations that apply to said services or information. Said third party will be subject to the obligations established in said regulations, and may develop its own operating procedures to satisfy them.
Specific procedures for reporting and resolving incidents will be established.
When any aspect of the Policy cannot be satisfied by a third party as required in the previous paragraphs, a report will be required from the Security Manager specifying the risks incurred and how to deal with them. Approval of this report by those responsible for the information and services affected will be required before proceeding.
In addition to the legal requirements regarding security, ASCIRES is also obliged to comply with the specific security requirements demanded by its clients and suppliers in relation to the information they access by virtue of their contractual relationships with them.
ASCIRES will create and maintain an updated map of contractual obligations in which the obligations related to the security of the confidential information and personal data it accesses or processes will be identified and prioritised.
It will be ensured that third-party personnel are adequately aware of security, at least at the same level as that established in this Policy.
ASCIRES will periodically check that the contractual obligations assumed in terms of security are integrated into this security policy or into the rules and procedures that develop it. Otherwise, this integration will be carried out.
This document has been approved on 10/01/2023.
This Information Security Policy is effective from that date and until it is replaced by a new Policy.
It will be reviewed by the Security Officer at planned intervals, which may not exceed one year in duration, or whenever significant changes occur, in order to ensure that its suitability, adequacy and effectiveness are maintained.
Changes to the Information Security Policy must be approved by the corresponding competent higher body, in accordance with article 13 of the ENS.
Any changes to it must be disseminated to all parties affected.
Ascires has the ENS certification with the MEDIA category for its medical centers in the Valencian Community and Madrid.
